Bug 24589 - xdm-1.1.9: core dump in SessionExit -> PAM -> strlen()
Summary: xdm-1.1.9: core dump in SessionExit -> PAM -> strlen()
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: App/xdm (show other bugs)
Version: git
Hardware: All Linux (All)
: medium critical
Assignee: Xorg Project Team
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords: patch
Depends on:
Blocks: 25045
  Show dependency treegraph
 
Reported: 2009-10-17 04:06 UTC by Martin Mokrejs
Modified: 2010-02-01 08:19 UTC (History)
5 users (show)

See Also:
i915 platform:
i915 features:


Attachments
backtrace of the segfaulting xdm process (7.50 KB, text/plain)
2009-11-13 09:47 UTC, Johannes Dewender
no flags Details
xdm.log of the segfaulting xdm after logout (no new xdm started) (4.05 KB, text/plain)
2009-11-13 09:51 UTC, Johannes Dewender
no flags Details
xdm-Call-openlog-3-early.patch (2.50 KB, patch)
2010-01-12 09:49 UTC, Dmitry V. Levin
no flags Details | Splinter Review
ptached-xdm-crashes-on-krb-passwd.txt (9.63 KB, text/plain)
2010-01-19 05:28 UTC, Martin Mokrejs
no flags Details

Description Martin Mokrejs 2009-10-17 04:06:35 UTC
There is a bugreport in Gentoo linux where several observed xdm crash when window manager is quit. Personally I use fvwm2 on linux-2.6.30.9 and glibc-2.10.1. I am not sure this is a xdm issue or PAM or glibc issue but was asked to report upstream. Please follow http://bugs.gentoo.org/show_bug.cgi?id=286923 and look for the attachments with "fvwm2" in its name. In brief:

(gdb) where
#0  strlen () at ../sysdeps/i386/i486/strlen.S:40
#1  0xb7cb6c98 in fputs_unlocked (str=0xb8003d55 <Address 0xb8003d55 out of bounds>, fp=0x8076eb8) at iofputs_u.c:37
#2  0xb7d1993a in __vsyslog_chk (pri=86, flag=1, fmt=0xb7db2a6a "%s %s", ap=0xbfa0bb8c "�006\b \221\006\b\031\034۷����") at ../misc/syslog.c:207
#3  0xb7d19db6 in __syslog_chk (pri=86, flag=1, fmt=0xb7db2a6a "%s %s") at ../misc/syslog.c:131
#4  0xb7db0226 in pam_vsyslog (pamh=0x80bb210, priority=86, fmt=0xb797a69e "session closed for user %s", args=0xbfa0bbfc "�D\f\b") at /usr/include/bits/syslog.h:32
#5  0xb7db02fb in pam_syslog (pamh=0x80bb210, priority=6, fmt=0xb797a69e "session closed for user %s") at pam_syslog.c:113
#6  0xb7974bdb in pam_sm_close_session (pamh=0x80bb210, flags=0, argc=0, argv=0x80c0558) at pam_unix_sess.c:125
#7  0xb7dab4b5 in _pam_dispatch (pamh=0x80bb210, flags=0, choice=5) at pam_dispatch.c:110
#8  0xb7daf4c3 in pam_close_session (pamh=0x0, flags=0) at pam_session.c:44
#9  0x0805340d in SessionExit (d=0x8068298, status=0, removeAuth=1) at session.c:480
#10 0x08053be9 in ManageSession (d=0x8068298) at session.c:375
#11 0x080506b0 in StartDisplay (d=0x8068298) at dm.c:762
#12 0x0804fbdc in ForEachDisplay (f=0x805079e <CheckDisplayStatus>) at dpylist.c:54
#13 0x08051267 in main (argc=1, argv=0xbfa0c304) at dm.c:630
Current language:  auto; currently asm
(gdb) bt full
#0  strlen () at ../sysdeps/i386/i486/strlen.S:40
No locals.
#1  0xb7cb6c98 in fputs_unlocked (str=0xb8003d55 <Address 0xb8003d55 out of bounds>, fp=0x8076eb8) at iofputs_u.c:37
        result = <value optimized out>
[cut]
Comment 1 Johannes Dewender 2009-11-13 09:47:12 UTC
Created attachment 31179 [details]
backtrace of the segfaulting xdm process

I also have two different segfaults leading to a broken XDMCP setup in
https://bugs.freedesktop.org/show_bug.cgi?id=25045

This is the backtrace of the segfaulting process when I close fluxbox (window manager)

This is the moment the segfault occurs and shows up as
Nov 13 18:14:56 haljo kernel: xdm[24782]: segfault at 7fdc0079dd10 ip 00007fdc018c8272 sp 00007fff2be4bc78 error 4 in libc-2.11.so[7fdc0184d000+14d000]
Comment 2 Johannes Dewender 2009-11-13 09:51:13 UTC
Created attachment 31180 [details]
xdm.log of the segfaulting xdm after logout (no new xdm started)

In order to generate a xdm.log for the segfaulting process I changed xdm in /etc/inittab form respawn to once. So no new xdm gets started and the log file is not overwritten.

Interesting part should be:
xdm error (pid 24777): Unknown session exit code 2816 from process 24782
xdm info (pid 24777): Exiting

The participating processes:
root     24777     1  0 18:14 ?        00:00:00 /usr/bin/xdm -nodaemon -config /etc/X11/xdm/haljo/xdm-config
root     24779 24777  3 18:14 tty7     00:00:01 /usr/bin/X :0 -auth /var/lib/xdm/authdir/authfiles/A:0-OHeSiQ
root     24782 24777  0 18:14 ?        00:00:00 -:0
Comment 3 Dmitry V. Levin 2010-01-12 09:49:33 UTC
Created attachment 32596 [details] [review]
xdm-Call-openlog-3-early.patch

Proposed fix.
Comment 4 Alan Coopersmith 2010-01-12 10:00:09 UTC
Awesome find - thanks for solving this.   I've pushed the patch to git master.
(Will probably do a new xdm release once some other patches are merged from
 debian and a few other bug reports.)
Comment 5 Martin Mokrejs 2010-01-19 05:28:12 UTC
Created attachment 32712 [details]
ptached-xdm-crashes-on-krb-passwd.txt

The patch fixes the problem with xdm crashing on logout for me. Unfortunately, not the issue with a crash on login when I enter valid kerberos password. I will instead the new stacktrace here instead of poking around the many other xdm core dumps reported in bugzilla. Please let me know if you think this is a separate issue. In my eyes the current stacktrace with Dmitrij's patch still points to syslog stuff.
Comment 6 Julien Cristau 2010-01-19 05:55:44 UTC
> --- Comment #5 from Martin Mokrejs <mmokrejs@ribosome.natur.cuni.cz>  2010-01-19 05:28:12 PST ---
> Created an attachment (id=32712)
>  --> (http://bugs.freedesktop.org/attachment.cgi?id=32712)
> ptached-xdm-crashes-on-krb-passwd.txt
> 
Looks like pam_get_item(PAM_USER) doesn't return a valid username?
Comment 7 Martin Mokrejs 2010-02-01 08:19:11 UTC
(In reply to comment #6)
> > --- Comment #5 from Martin Mokrejs <mmokrejs@ribosome.natur.cuni.cz>  2010-01-19 05:28:12 PST ---
> > Created an attachment (id=32712) [details]
> >  --> (http://bugs.freedesktop.org/attachment.cgi?id=32712)
> > ptached-xdm-crashes-on-krb-passwd.txt
> > 
> Looks like pam_get_item(PAM_USER) doesn't return a valid username?

I did use valid username which is even same as a local username. And, I can get my kerberos ticket from my shell.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.